The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
HighVulnerability
CVE-2026-99227: In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: prevent cancel reference wrap…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-99227
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.1%
Summary
The Linux kernel io_uring subsystem contains a flaw in io_waitid, where repeated failed cancellation attempts increment the 31-bit reference field in ->refs. The counter can wrap to zero, letting a later cancellation claim ownership and complete the request a second time.
Mitigation
Use atomic_fetch_or() when setting the cancel flag and inspect the old flag value, so later cancellation attempts return without incrementing the reference field. The first cancel attempt keeps its existing ownership increment.